NetSight
IP …
critical9.8Known exploited

CVE-2016-8735

Apache Tomcat Improper Access Control vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-05-12. Federal due date: 2023-06-02.

Apply updates per vendor instructions.

Impact

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.tomcat:tomcat-catalina< 6.0.486.0.48
mavenorg.apache.tomcat:tomcat-catalina-jmx-remote< 6.0.486.0.48

Affected products

VendorProductAffected versions
ApacheTomcat
before 6.0.48
from 7.0.0 before 7.0.73
from 8.0 before 8.0.39
from 8.5.0 before 8.5.7
Version 9.0.0
CanonicalUbuntu Linux
Version 16.04
Netapp7-Mode Transition Tool
All versions
NetappOncommand Insight
All versions
NetappOncommand Shift
All versions
NetappSnap Creator Framework
All versions
DebianDebian Linux
Version 8.0
RedhatJboss Enterprise Web Server
Version 3.0.0
OracleAgile Engineering Data Management
Versions 6.1.3, 6.2.0, 6.2.1.0
OracleAgile Product Lifecycle Management
Versions 9.3.5, 9.3.6
OracleCommunications Application Session Controller
Versions 3.7.1, 3.8.0
OracleCommunications Instant Messaging Server
Version 10.0.1

Weakness classification

CWE-284

References